opencode bcae59626f feat(security): add CSRF protection for all state-changing API routes ...

- Synchronizer token stored in session; GET /auth/csrf to obtain it
- csrfProtection middleware requires X-CSRF-Token on non-safe methods
- customFetch injects the header via setCsrfTokenGetter
- toolrate boot loads token; reload after local login (session regenerate)
- OpenAPI GET /auth/csrf + CsrfToken schema, orval regenerated

2026-08-03 10:30:13 +02:00

34 KiB

Raw Blame History